Bail out location.hash setter when set to the current hash

This adds a special case which is necessary for compatibility with deployed content, and implemented in 2/3 engines. Closes #7386.

source

@@ -86979,6 +86979,19 @@ interface <dfn interface>Location</dfn> { // but see also <a href="#the-location
    state</span> as <span data-x="basic url parser state override"><i>state
    override</i></span>.</p></li>
 
+   <li>
+    <p>If <var>copyURL</var>'s <span data-x="concept-url-fragment">fragment</span> equals
+    <span>this</span>'s <span data-x="concept-location-url">url</span>'s <span
+    data-x="concept-url-fragment">fragment</span>, then return.</p>
+
+    <p class="note">This bailout is necessary for compatibility with deployed content, which <a
+    href="https://bugzilla.mozilla.org/show_bug.cgi?id=1733797#c2">redundantly sets <code
+    data-x="dom-location-hash">location.hash</code> on scroll</a>. It does not apply to other
+    mechanisms of fragment navigation, such as the <code
+    data-x="dom-location-href">location.href</code> setter or <code
+    data-x="dom-location-assign">location.assign()</code>.</p>
+   </li>
+
    <li><p><span><code>Location</code>-object navigate</span> to <var>copyURL</var>.</p></li>
   </ol>